In other words, if the user does not "approve" the enrollment, some security-related management functionality is limited or prevented. This new enrollment state provides Apple a way to prevent some management functionality until the end-user acknowledges (and approves) the device management. User-Approved MDM enrollment was introduced in macOS High Sierra as a way to prevent IT administrators (or malware attacks) from being able to silently gain full control over macOS. It is important to note the subtle differences between these three types of users as we begin discussing enrollment scenarios.
In other words, this is the user account that must be logged-on within macOS in order for Workspace ONE to deliver items assigned to the Workspace ONE UEM enrollment user. This is the macOS user account Workspace ONE UEM can target using Apple Push Notifications when it is also the logged-on user. This is the user account (either local to macOS or based from a Network Account Server) that was logged-on and active on the device when enrollment occurred. This is a user account (either local to macOS or based from a directory service such as Active Directory) that is currently logged-on and active on the device. In other words, this is the user account to which Workspace ONE UEM considers the device assigned. This is the user account Workspace ONE is using to determine membership within assignment groups. If staging a device, this is the user account to which the device is assigned within Workspace ONE UEM (under Devices > Details View > User). 
If not staging a device, this is a user account (either basic or directory-based) within Workspace ONE UEM (under Accounts > Users > List View) whose credentials were entered at the time the device was enrolled. Although macOS is an inherently multi-user system, the mdmclient process built-in to macOS (leveraged by Workspace ONE UEM) is not multi-user capable unless the device is bound to a directory service (such as Active Directory).Īs such, when discussing enrollment workflows for macOS, we must first define three different types of users. MacOS inherently supports a number of discrete user accounts (each with their own data and settings). Single-User Staging for Local Users with Pre-Registration Using Apple Business Manager Enrollment. Single-User Staging for Local Users with Pre-Registration Using Agent-Based Enrollment. Staging Single-User, Off-Domain macOS Enrollment. Multi-User Staging Using Apple Business Manager Enrollment. 
Multi-User Staging Using Agent-Based Enrollment. Staging Multi-User, Domain-Bound macOS Enrollment. Single-User Staging Using Apple Business Manager Enrollment. Single-User Staging Using Agent-Based Enrollment. Staging Single-User, Domain-Bound macOS Enrollment. Onboarding Using User-Initiated, Apple Business Manager Enrollment. Onboarding Using User-Initiated, Agent-Based Enrollment. Non-Staging, User-Initiated macOS Enrollment.
0 kommentar(er)
